Overview

overview

10

Static

static

10

1028b6555f...66.exe

windows7_x64

10

1028b6555f...66.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1028b6555f6d225a3dae8eee2062a9d2bfde660140c2e96dc02d8e9b5018d166

  • Size

    80KB

  • Sample

    220212-g5jwjaaegr

  • MD5

    f16ecd59dd345f2b479da32d6d1914cc

  • SHA1

    239b79de408c2394bd8ceed66d02e07d6cd91b41

  • SHA256

    1028b6555f6d225a3dae8eee2062a9d2bfde660140c2e96dc02d8e9b5018d166

  • SHA512

    0fbd3583473108af7344a161f25a1dcbcd6cb299fc93607e5fdd15c90c03e30b552a568314ec8115b910201f1b8df6810818341f708824ab0c2495e7da43b00f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1028b6555f6d225a3dae8eee2062a9d2bfde660140c2e96dc02d8e9b5018d166

    • Size

      80KB

    • MD5

      f16ecd59dd345f2b479da32d6d1914cc

    • SHA1

      239b79de408c2394bd8ceed66d02e07d6cd91b41

    • SHA256

      1028b6555f6d225a3dae8eee2062a9d2bfde660140c2e96dc02d8e9b5018d166

    • SHA512

      0fbd3583473108af7344a161f25a1dcbcd6cb299fc93607e5fdd15c90c03e30b552a568314ec8115b910201f1b8df6810818341f708824ab0c2495e7da43b00f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks